JP2004102071A - Polynomial remainder system arithmetic device, method, and program - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To handle an arbitrary rule polynomial, to reduce a required memory size and to improve processing efficiency in a polynomial remainder system arithmetic device. <P>SOLUTION: The device is provided with a plurality of arithmetic units 10<SB>1</SB>to 10<SB>n</SB>having a polynomial remainder arithmetic function on GF(2) based on each element f<SB>i</SB>,g<SB>i</SB>(where i=1 to n) of the bases of a polynomial remainder arithmetic system. When m dimensional agreement polynomial N(x) on GF(2) and polynomials a(x) and b(x) on an equal to or less than m dimensional GF(2) are inputted into the units, remainder operations at the base elements f<SB>i</SB>, g<SB>i</SB>for input contents N(x), a(x) and b(x) are executed in parallel at the units and a Montgomery multiplication a(x)b(x)G(x)<SP>-1</SP>mod N(x) is computed uning G(x)=g<SB>1</SB>(x)g<SB>2</SB>(x) to g<SB>n</SB>(x). Thus, parallel computations are executed by the arithmetic units employing polynomial remainder system expression without using a multiple table which normally requires a memory size and without conducting computations for conventional polynomial expression. Moreover, the parallel computations use a Montgomery multiplication. <P>COPYRIGHT: (C)2004,JPO

Description

【００４２】
ここで、Ｆ_ｉ（ｘ）＝Ｆ（ｘ）／ｆ_ｉ（ｘ）である。Ｆ_ｉ（ｘ）^−１は、法ｆ_ｉ（ｘ）におけるＦ_ｉ（ｘ）の乗法逆元である。
【００４３】
上の式（１）は次の式（２）のように書いても良い。
【００４４】
【数２】

【００４５】
ここで、右辺のｍｏｄ　Ｆ（ｘ）を施す前の次数は、以下のように、ｄｅｇ（Ｆ（ｘ））より小さい値となる。
【００４６】
ｍａｘ｛ｄｅｇ（ｆ_ｉ（ｘ））＋ｄｅｇ（Ｆ_ｉ（ｘ））｝＜ｍａｘ｛ｄｅｇ（ｆ_ｉ（ｘ））＋ｄｅｇ（Ｆ（ｘ））−ｄｅｇ（ｆ_ｉ（ｘ））｝＝ｄｅｇ（Ｆ（ｘ））
従って、式（２）は、ｍｏｄ　Ｆ（ｘ）を省略し、次の式（３）として表現される。
【数３】

式（３）によると、乗算と加算でβ（ｘ）を求めることができる。
【００４７】
＜β（ｘ）＞_ｇ　はこのようにして求めたβ（ｘ）を、各基底要素ｇ_ｉ（ｘ）　での剰余を計算することで得られる。
【００４８】
続いて、以上のようなＰＲＳ表現を用いたモンゴメリ乗算アルゴリズムを実現する本発明の各実施形態について図面を用いて説明する。
（第１の実施形態）
図１は本発明の第１の実施形態に係る多項式剰余系演算装置の構成を示す模式図である。この多項式剰余系演算装置は、ｎ個の演算ユニット１０_１〜１０_ｎが制御装置２０に接続されている。
【００４９】
ここで、各演算ユニット１０_１〜１０_ｎは、制御装置２０に制御され、単精度の多項式の剰余乗算を行うものであり、それぞれ対応する添字のＲＯＭ１１_１〜１１_ｎ、ＲＡＭ１２_１〜１２_ｎ及び積和回路１３_１〜１３_ｎを備えている。なお、各演算ユニット１０_１〜１０_ｎは、互いに同一構成を有するため、以下の説明は、任意の演算ユニット１０_ｉ（但し、ｉ＝１，２，…，ｎ）を代表例として述べる。また、演算ユニット１０_ｉの各要素１１_ｉ，１２_ｉ，１３_ｉも同様である。
【００５０】
ＲＯＭ１１_ｉは、制御装置２０により読出制御される読出専用メモリであり、積和回路１３_ｉで用いる基底要素ｆ_ｉ，ｇ_ｉ、及びｆ_ｉ（ｘ）を法とした乗法逆元値Ｆ_ｉ（ｘ）^−１ｍｏｄ　ｆ_ｉ（ｘ）、ｇ_ｉ（ｘ）を法とした乗法逆元値Ｇ_ｉ（ｘ）^−１ｍｏｄ　ｇ_ｉ（ｘ）、事前計算された＜Ｆ_ｉ（ｘ）＞_ｇ、＜Ｇ_ｉ（ｘ）＞_ｆ（ｉ＝１，２，…，ｎ）、＜Ｇ^−１（ｘ）＞_ｆを保持し、保持内容を制御装置２０からの制御により、対応する積和回路１３_ｉに転送可能となっている。
【００５１】
なお、多項式剰余系のｎ個の基底要素｛ｆ_１，…，ｆ_ｎ｝は、どの２つ同士も互いに素な多項式が使用されている。他方のｎ個の基底要素｛ｇ_１，…，ｇ_ｎ｝も同様である。また、一般には多項式剰余系の基底要素の個数ｎと、積和回路１３_１〜１３_ｎの個数ｎとは一致しなくてよいが、ここでは簡単のため、共にｎ個とする。
【００５２】
乗法逆元値Ｆ_ｉ（ｘ）^−１ｍｏｄ　ｆ_ｉ（ｘ）、Ｇ_ｉ（ｘ）^−１ｍｏｄ　ｇ_ｉ（ｘ）及び＜Ｆ_ｉ（ｘ）＞_ｇ、＜Ｇ_ｉ（ｘ）＞_ｆ（ｉ＝１，２，…，ｎ）、＜Ｇ^−１（ｘ）＞_ｆは、多項式剰余系の基底が定まれば決まる値なので、事前計算して格納するが、ＲＯＭ１１_ｉに限らず、ＲＡＭ１２_ｉや図示しない他のメモリ（例えばＥＥＰＲＯＭ）に格納されていてもよい。
【００５３】
ＲＡＭ（記憶装置）１２_ｉは、制御装置２０により読出／書込制御される随時書込読出メモリであり、積和回路１３_ｉへの入力データや、積和回路１３_ｉからの演算の中間結果データ、及び演算ユニット１０_ｉ外部への出力データ、といった各データを保持するために用いられる。また、ＲＡＭ１２_ｉは、事前計算された＜Ｎ（ｘ）＞_ｆ、＜Ｎ（ｘ）^−１＞_ｇ＜Ｎ（ｘ）＞_ｆが保持されている。また、ＲＡＭ１２_ｉは、書込可能な記憶装置であればよく、例えばＲＡＭに代えて、ＥＡＲＯＭ（ｅｌｅｃｔｒｉｃａｌｌｙ　ａｌｔｅｒａｂｌｅ　ｒｅａｄ　ｏｎｌｙ　ｍｅｍｏｒｙ）又はＥＥＰＲＯＭ（ｅｌｅｃｔｒｉｃａｌｌｙ　ｅｒａｓａｂｌｅ　ｐｒｏｇｒａｍｍａｂｌｅ　ｒｅａｄ　ｏｎｌｙ　ｍｅｍｏｒｙ）等、といった任意の書換え可能な記憶装置に変形可能となっている。
【００５４】
制御装置２０は、図２に示すモンゴメリ乗算アルゴリズムに基づいて、各演算ユニット１０_ｉや入出力データを制御することにより、所定の演算を実行させる機能をもっている。ここで、図２のモンゴメリ乗算アルゴリズムの各ステップＳＴ１１〜ＳＴ１７は、前述したＰＲＳにおける７つのステップＳＴ１１〜ＳＴ１７に対応している。また、各演算ユニット１０_ｉの制御としては、例えば、各積和回路１３_ｉ内にセレクタを設け、このセレクタに制御信号を与えて積和回路１３_ｉ内の加算回路や乗算回路（図示せず）を選択することにより実現可能となっている。
【００５５】
また、以上のような各演算ユニット１０_ｉ及び制御装置２０はそれぞれハードウェア、又はハードウェアとソフトウェアの組合せにより構成可能となっている。ここで、各演算ユニット１０_ｉ及び制御装置２０がハードウェアとソフトウェアにより構成される場合、ソフトウェアとしては、後述する各機能を実現させるためのプログラムが予め多項式剰余系演算装置のコンピュータにインストールされている。なお、ハードウェア、又はハードウェアとソフトウェアの組合せにより各演算ユニット１０_ｉ及び制御装置２０を個別に構成可能な旨の説明は、以下の各実施形態にも適用される。
【００５６】
次に、以上のように構成された多項式剰余系演算装置による多項式剰余系演算方法について図２を用いて説明する。
始めに、基底ｆ_ｉ（ｘ），ｇ_ｉ（ｘ）は、予めＲＯＭ１１_ｉに保持されている。また、入力ａ（ｘ），ｂ（ｘ），法Ｎ（ｘ）は、制御装置２０により、各演算ユニット１０_ｉに設定される。
【００５７】
（ＳＴ１１）　各演算ユニット１０_ｉは、２つの基底ｆ，ｇの下で、それぞれａ（ｘ）×ｂ（ｘ）を行う。例えば基底ｆの下での　＜ａ（ｘ）＞_ｆ　×　＜ｂ（ｘ）＞_ｆ　は次のように行う。
【００５８】
すなわち、ＲＡＭ１２_ｉ内の　＜ａ（ｘ）＞_ｆ，＜ｂ（ｘ）＞_ｆ　の第ｉ成分ａ_ｉ（ｘ），ｂ_ｉ（ｘ）と、ＲＯＭ１１_ｉ内の基底要素ｆ_ｉ（ｘ）とを用い、積和回路１３_ｉがａ_ｉ（ｘ）×ｂ_ｉ（ｘ）　ｍｏｄ　ｆ_ｉ（ｘ）を計算し、計算結果ｓ_ｉ（ｘ）をＲＡＭ１２_ｉに格納する。
【００５９】
（ＳＴ１２）　各演算ユニット１０_ｉは、基底ｇのみの演算で、ステップ１で求めた＜ｓ（ｘ）＞_ｇと、ＲＡＭ１２_ｉ内の＜Ｎ（ｘ）^−１＞_ｇとを乗算する。なお、＜Ｎ（ｘ）^−１＞_ｇ　は事前計算により　ＲＡＭ１２_ｉに格納されている。
【００６０】
（ＳＴ１３）　各演算ユニット１０_ｉは、＜ｔ（ｘ）＞_ｇを基底ｇから基底ｆへの表現に変換する基底拡張を行なう。基底拡張は、式（３）に基づいて行なう（β（ｘ）＝ｔ（ｘ）とし、ｆとｇの役割を入れ替える）。
【００６１】
まず、各演算ユニット１０_ｊは、ＲＡＭ１２_ｊ内の　＜ｔ（ｘ）＞_ｇ　の第ｊ成分ｔ_ｊ（ｘ）と、ＲＯＭ１１_ｊ内の　Ｇ_ｊ（ｘ）^−１　ｍｏｄ　ｇ_ｊ（ｘ），基底要素ｇ_ｊ（ｘ）　を用い、積和回路１３_ｊによりｔ_ｊ（ｘ）×Ｇ_ｊ（ｘ）^−１　ｍｏｄ　ｇ_ｊ（ｘ）を計算し、計算結果ｈ_ｊ（ｘ）をすべてのｊについてＲＡＭ１２_１、ＲＡＭ１２_２、…、ＲＡＭ１２_ｎすべてに格納する。ここで各演算ユニット間には図示しない結線があり、この結線を通じて異なるユニットのＲＡＭ１２_ｉに格納する。
【００６２】
次に、この計算結果ｈ_１（ｘ）及びＲＯＭ１１_ｉ内のＧ_１（ｘ）　ｍｏｄ　ｆ_ｉ（ｘ），基底要素　ｆ_ｉ（ｘ）を用い、積和回路１３_ｉによりｈ_１（ｘ）×Ｇ_１（ｘ）　ｍｏｄ　ｆ_ｉ（ｘ）を計算し、この計算結果ｋ_１ｉ（ｘ）をＲＡＭ１２_ｉに格納する。
【００６３】
次に、ＲＡＭ１２_ｉ内のｈ_２（ｘ）及びＲＯＭ１１_ｉ内のＧ_２（ｘ）　ｍｏｄ　ｆ_ｉ（ｘ），基底要素ｆ_ｉ（ｘ）を用い、積和回路１３_ｉによりｈ_２（ｘ）×Ｇ_２（ｘ）　ｍｏｄ　ｆ_ｉ（ｘ）を計算し、この計算結果とＲＡＭ１２_ｉ内のｋ_１ｉ（ｘ）とを加算したｋ_２ｉ（ｘ）をＲＡＭ１２_ｉに格納する。
【００６４】
以下同様に、Ｇ_３（ｘ）　ｍｏｄ　ｆ_ｉ（ｘ），…，Ｇ_ｎ（ｘ）　ｍｏｄ　ｆ_ｉ（ｘ）を順に用いてｋ_３ｉ（ｘ），…，ｋ_ｎｉ（ｘ）を求め、ｔ（ｘ）　ｍｏｄ　ｆ_ｉ（ｘ）＝　ｋ_ｎｉ（ｘ）とおくことで　＜ｔ（ｘ）＞_ｆ　を得ることができる。
【００６５】
（ＳＴ１４）　各演算ユニット１０_ｉは、ステップＳＴ１３で求めた＜ｔ（ｘ）＞_ｆと、ＲＡＭ１２_ｉ内の＜Ｎ（ｘ）＞_ｆ　とを積和回路１３_ｉにより乗算し、乗算結果＜ｕ（ｘ）＞_ｆ　をＲＡＭ１２_ｉに格納する。ここで、＜Ｎ（ｘ）＞_ｆ　は事前計算によりＲＡＭ１２_ｉに格納されている。
【００６６】
（ＳＴ１５）　各演算ユニット１０_ｉは、ステップＳＴ１１で求めた＜ｓ（ｘ）＞_ｆと、ステップＳＴ１４で求めた＜ｕ（ｘ）＞_ｆとを積和回路１３_ｉにより加算し、加算結果＜ｖ（ｘ）＞_ｆ　をＲＡＭ１２_ｉに格納する。
【００６７】
（ＳＴ１６）　各演算ユニット１０_ｉは、ステップＳＴ１５で求めた＜ｖ（ｘ）＞_ｆ　と、ＲＯＭ１１_ｉ内の＜Ｇ（ｘ）^−１＞_ｆとを積和回路１３_ｉにより乗算し、乗算結果＜ｗ（ｘ）＞_ｆ　をＲＡＭ１２_ｉに格納する。ここで、＜Ｇ（ｘ）^−１＞_ｆは事前計算してＲＯＭ１１_ｉに格納されている。
このステップＳＴ１６で得られた＜ｗ（ｘ）＞_ｆ　に、求めたかったａ（ｘ）ｂ（ｘ）Ｇ（ｘ）^−１　ｍｏｄ　Ｎ（ｘ）の全ての情報が含まれている。
【００６８】
（ＳＴ１７）　このアルゴリズムを繰り返し用いる場合、各演算ユニット１０_ｉは、次の入力とするために、ステップＳＴ１６の＜ｗ（ｘ）＞_ｆ　を基底ｆから基底ｇに変換する。
【００６９】
上述したように本実施形態によれば、従来とは異なり、巨大なメモリサイズを要する倍数テーブルを用いることなく、また、通常の多項式の表現での計算をすることなく、多項式剰余系表現を用いて各演算ユニットに並列に演算を実行させている。また法多項式の倍数テーブルのような、法多項式を限定してしまうパラメータは用いていないため、任意の法多項式に対して演算可能である。さらに、並列演算としては、除算を避けるために、多項式剰余系表現では従来用いられなかったモンゴメリ乗算を用いている。
従って、多項式剰余系の演算に関し、必要なメモリサイズを低減でき、且つ処理効率を向上させる、さらに任意の法多項式を扱うことができる。
【００７０】
補足すると、従来技術では巨大な倍数テーブルが必要であったり、ＰＲＳ表現と通常の多項式の表現で二重に処理を行ったりして効率を落としていたが、本実施形態では、倍数テーブルは不要であり、計算もＰＲＳ表現で閉じているため、効率よく処理できるようになっている。また、従来技術では倍数テーブルを用意することにより扱える法多項式が限定されていたが、本実施形態では、基底要素と互いに素であれば、任意の法多項式が扱えるようになっている。
【００７１】
これに加え、本実施形態では、ＰＲＳ表現におけるモンゴメリ乗算を行うことができるので、より一層、効率よく処理できるようになっている。
【００７２】
（第２の実施形態）
図３は本発明の第２の実施形態に係る多項式剰余系演算装置の構成を示す模式図であり、図１と同一部分には同一符号を付してその詳しい説明を省略し、ここでは異なる部分について主に述べる。
【００７３】
本実施形態は、第１の実施形態におけるＰＲＳ表現のモンゴメリ乗算を楕円曲線暗号に用いた応用例であり、図１の制御装置２０に代えて、楕円曲線暗号のアルゴリズムに基づいた制御を行なう制御装置３０を有しており、また、各演算ユニット１０_ｉに対する共通の入出力部（図中Ｉ／Ｏ）４０を備えている。
【００７４】
ここで、制御装置３０は、ＰＲＳ表現においてＧＦ（２^ｍ）上の楕円曲線暗号の処理に必要な楕円曲線上の点のスカラー倍算を行うためのものであり、図４及び図５に示すスカラ倍算アルゴリズムに基づいて、各演算ユニット１０_ｉや入出力データを制御することにより、所定の演算を実行させる機能をもっている。
【００７５】
入出力部４０は、多項式剰余系演算装置の外部と、各演算ユニット１０_ｉとの間でデータを入出力するためのインターフェイスである。
【００７６】
次に、以上のように構成された多項式剰余系演算装置における多項式剰余系演算方法を図４及び図５を用いて説明する。ここで、図４はＰＲＳにおける楕円曲線上の点のスカラー倍算を行うアルゴリズムを示し、図５は図４のアルゴリズムの途中において、射影座標でモンゴメリ演算領域の楕円曲線上の点のスカラー倍算を行うアルゴリズムを示している。
【００７７】
始めに、図４を用いて説明する。
（ＳＴ２１）　図示しない外部ＣＰＵは、スカラーｋを各演算ユニット１０_ｉに入力する。また、入出力部４０は、楕円曲線上の点（Ｐ_ｘ（ｘ），Ｐ_ｙ（ｘ））、法Ｎ（ｘ）を各演算ユニット１０_ｉに入力する。
【００７８】
（ＳＴ２２）　図示しない通常の多項式の表現での剰余乗算器により、ＧＮ（ｘ）２＝Ｇ（ｘ）２　ｍｏｄ　Ｎ（ｘ）を計算する。
【００７９】
（ＳＴ２３）　各演算ユニット１０_ｉは、通常の多項式の表現であるＧ_Ｎ（ｘ） ^２，　Ｎ（ｘ），Ｐ_ｘ（ｘ），Ｐ_ｙ（ｘ）をＰＲＳ表現に変換する。この変換は、積和回路１３_ｉのビットサイズをＬとしたとき、例えばＮ（ｘ）をＰＲＳ表現にするには、
【数４】

【００８０】
（ＳＴ２４）　各演算ユニット１０_ｉは、モンゴメリ乗算で必要な　＜Ｎ（ｘ）^−１＞_ｇを計算する。＜Ｎ（ｘ）^−１＞_ｇは、ｇ_ｉ（ｘ）のカーマイケル数λ_ｉを事前に計算しておき、Ｎ_ｉ（ｘ）^{λ ｉ}　ｍｏｄ　ｇ_ｉ（ｘ）により求める。
【００８１】
（ＳＴ２５）　各演算ユニット１０_ｉは、アフィン座標表示された（＜Ｐ_ｘ（ｘ）＞_{ｆ ∪ ｇ}，　＜Ｐ_ｙ（ｘ）＞_{ｆ ∪ ｇ}）を射影座標かつモンゴメリ演算領域（＜Ｐ_ｍｘ（ｘ）＞_{ｆ ∪ ｇ}，　＜Ｐ_ｍｙ（ｘ）＞_{ｆ ∪ ｇ}，＜Ｇ_Ｎ（ｘ）＞_{ｆ ∪ ｇ}）に変換する。
この変換は、ｘ，　ｙ座標に関しては＜Ｇ_Ｎ（ｘ） ^２＞_{ｆ ∪ ｇ}　とのモンゴメリ乗算により計算できる。ｚ座標に関しては　＜Ｇ_Ｎ（ｘ） ^２＞_{ｆ ∪ ｇ}　と＜１＞_{ｆ ∪ ｇ}　のモンゴメリ乗算により計算できる。
【００８２】
（ＳＴ２６）　各演算ユニット１０_ｉは、楕円曲線上の点（＜Ｐ_ｍｘ（ｘ）＞_{ｆ ∪ ｇ}，　＜Ｐ_ｍｙ（ｘ）＞_{ｆ ∪ ｇ}，＜Ｇ_Ｎ（ｘ）＞_{ｆ ∪ ｇ}）をｋ倍して（＜Ｑ_ｐｍｘ（ｘ）＞_{ｆ ∪ ｇ}，＜Ｑｐｍｙ（ｘ）＞_{ｆ ∪ ｇ}，＜Ｑ_ｐｍｚ（ｘ）＞_{ｆ ∪ ｇ}）を得る。なお、本ステップＳＴ２６は後で図５を用いて詳述する。
【００８３】
（ＳＴ２７）　各演算ユニット１０_ｉは、（＜Ｑ_ｐｍｘ（ｘ）＞_{ｆ ∪ ｇ}，＜Ｑ_ｐｍｙ（ｘ）＞_{ｆ ∪ ｇ}，＜Ｑ_ｐｍｚ（ｘ）＞_{ｆ ∪ ｇ}）をモンゴメリ演算領域から通常の領域（＜Ｑ_Ｐｘ（ｘ）＞_{ｆ ∪ ｇ}，＜Ｑ_Ｐｙ（ｘ）＞_{ｆ ∪ ｇ}，＜Ｑ_Ｐｚ（ｘ）＞_{ｆ ∪ ｇ}）に変換する。この変換は、各成分と＜１＞_{ｆ ∪ ｇ}とのモンゴメリ乗算で計算できる。
【００８４】
（ＳＴ２８）　各演算ユニット１０_ｉは、＜Ｑ_Ｐｘ（ｘ）＞_{ｆ ∪ ｇ}，＜Ｑ_Ｐｙ（ｘ）＞_{ｆ ∪ ｇ}，＜Ｑ_Ｐｚ（ｘ）＞_{ｆ ∪ ｇ}を通常の多項式の表現　Ｑ_Ｐｘ（ｘ），Ｑ_Ｐｙ（ｘ），Ｑ_Ｐｚ（ｘ）に変換する。
例えば＜Ｑ_Ｐｘ（ｘ）＞_ｆについては次のように行う。
ξ_ｉ（ｘ）＝Ｑ_Ｐｘｉ（ｘ）Ｇ_ｉ（ｘ）^−１　ｍｏｄ　ｇ_ｉ（ｘ）
とし、
【数５】

【００８５】
これにより、Ｑ_Ｐｘ（ｘ）の通常の多項式の表現が得られる。Ｑ_Ｐｘ（ｘ）は基底ｆのみで表現できているので、＜Ｑ_Ｐｘ（ｘ）＞_ｇに関する操作は不要である。
【００８６】
（ＳＴ２９）　各演算ユニット１０_ｉは、射影座標表示された楕円曲線上の点（Ｑ_Ｐｘ（ｘ），Ｑ_Ｐｙ（ｘ），Ｑ_Ｐｚ（ｘ））をアフィン座標表示（Ｑ_ｘ（ｘ），Ｑ_ｙ（ｘ））に変換する。
【００８７】
（ＳＴ３０）　各演算ユニット１０_ｉは、アフィン座標表示の（Ｑ_ｘ（ｘ），Ｑ_Ｐ（ｘ））を出力する。
【００８８】
次に、前述したステップＳＴ２６のスカラー倍算を図５を用いて詳細に説明する。
【００８９】
（ＳＴ２６−１）　各演算ユニット１０_ｉは、まず入力として、スカラーｋと、射影座標かつモンゴメリ演算領域で表現された楕円曲線上の点（Ｐ_Ｐｍｘ（ｘ），Ｐ_Ｐｍｙ（ｘ），Ｐ_Ｐｍｚ（ｘ））が与えられる。
【００９０】
（ＳＴ２６−２）　各演算ユニット１０_ｉは、初期値として（Ｑ_Ｐｍｘ（ｘ），Ｑ_Ｐｍｙ（ｘ），Ｑ_Ｐｍｚ（ｘ））に（Ｐ_Ｐｍｘ（ｘ），Ｐ_Ｐｍｙ（ｘ），Ｐ_Ｐｍｚ（ｘ））を代入する。以下、スカラーｋをビット表現したときの第ｉビットをｋ_ｃで表すことにする。スカラーｋのＭＳＢ（最上位）ビットｋ_ｍ−１からｋ_１まで順に以下のループを行う。
【００９１】
（ＳＴ２６−３）　各演算ユニット１０_ｉは、（Ｑ_Ｐｍｘ（ｘ），Ｑ_Ｐｍｙ（ｘ），Ｑ_Ｐｍｚ（ｘ））を２倍する。
【００９２】
（Ｑ_Ｐｍｘ（ｘ），Ｑ_Ｐｍｙ（ｘ），Ｑ_Ｐｍｚ（ｘ））←　ＤＢＬ（（Ｑ_Ｐｍｘ（ｘ），Ｑ_Ｐｍｙ（ｘ），Ｑ_Ｐｍｚ（ｘ）），（Ｑ_Ｐｍｘ（ｘ），Ｑ_Ｐｍｙ（ｘ），Ｑ_Ｐｍｚ（ｘ）））。ここで、ＤＢＬ（　）は、楕円曲線上の点の２倍算を意味する。
【００９３】
（ＳＴ２６−４）　制御装置３０は、ｋ_ｃ＝１か否かを判定し、ｋ_ｃ＝１の場合にはステップＳ２６−５に進む。ｋ_ｃ＝０の場合は、この加算を行わず、ループの先頭（ＳＴ２６−３）に戻る。なお、ループの先頭に戻る毎にｃの値を１ずつ減じる。
【００９４】
（ＳＴ２６−５）　各演算ユニット１０_ｉは、（Ｑ_Ｐｍｘ（ｘ），Ｑ_Ｐｍｙ（ｘ），Ｑ_Ｐｍｚ（ｘ））に（Ｐ_Ｐｍｘ（ｘ），Ｐ_Ｐｍｙ（ｘ），Ｐ_Ｐｍｚ（ｘ））を加算する。
【００９５】
（Ｑ_Ｐｍｘ（ｘ），Ｑ_Ｐｍｙ（ｘ），Ｑ_Ｐｍｚ（ｘ））←　ＡＤＤ（（Ｑ_Ｐｍｘ（ｘ），Ｑ_Ｐｍｙ（ｘ），Ｑ_Ｐｍｚ（ｘ）），（Ｐ_Ｐｍｘ（ｘ），Ｐ_Ｐｍｙ（ｘ），Ｐ_Ｐｍｚ（ｘ）））。ここで、ＡＤＤ（　）は、楕円曲線上の点の加算を意味する。
【００９６】
（ＳＴ２６−６）　制御装置３０は、ｃ＝１か否かを判定し、ｃ≠１の場合にはｃの値を１だけ減じ、ループの先頭（ＳＴ２６−３）に戻る。ｃ＝１のときにループを終了し、ステップＳＴ２６−７に進む。
【００９７】
（ＳＴ２６−７）　各演算ユニット１０_ｉは、（Ｑ_Ｐｍｘ（ｘ），Ｑ_Ｐｍｙ（ｘ），Ｑ_Ｐｍｚ（ｘ））を出力し、ステップＳＴ２７に進む。
【００９８】
以上でステップＳＴ２６は完了する。ここで、図５は通常の多項式の表現で記述してあるが、各元をＰＲＳ表現に置き換えることで容易にＰＲＳ表現でのスカラー倍算を実現できる。このとき、ＡＤＤ（　）やＤＢＬ（　）で必要な剰余乗算を、第１の実施形態で示したＰＲＳ表現によるモンゴメリ乗算アルゴリズムを用いて行う。
【００９９】
上述したように本実施形態によれば、第１の実施形態の効果に加え、効率よく楕円曲線上の点のスカラー倍算処理を実行することができる。
【０１００】
なお、上記各実施形態に記載した手法は、コンピュータに実行させることのできるプログラムとして、磁気ディスク（フロッピー（登録商標）ディスク、ハードディスクなど）、光ディスク（ＣＤ−ＲＯＭ、ＤＶＤなど）、光磁気ディスク（ＭＯ）、半導体メモリなどの記憶媒体に格納して頒布することもできる。
【０１０１】
また、この記憶媒体としては、プログラムを記憶でき、かつコンピュータが読み取り可能な記憶媒体であれば、その記憶形式は何れの形態であっても良い。
【０１０２】
また、記憶媒体からコンピュータにインストールされたプログラムの指示に基づきコンピュータ上で稼働しているＯＳ（オペレーティングシステム）や、データベース管理ソフト、ネットワークソフト等のＭＷ（ミドルウェア）等が本実施形態を実現するための各処理の一部を実行しても良い。
【０１０３】
さらに、本発明における記憶媒体は、コンピュータと独立した媒体に限らず、ＬＡＮやインターネット等により伝送されたプログラムをダウンロードして記憶または一時記憶した記憶媒体も含まれる。
【０１０４】
また、記憶媒体は１つに限らず、複数の媒体から本実施形態における処理が実行される場合も本発明における記憶媒体に含まれ、媒体構成は何れの構成であっても良い。
【０１０５】
尚、本発明におけるコンピュータは、記憶媒体に記憶されたプログラムに基づき、本実施形態における各処理を実行するものであって、パソコン等の１つからなる装置、複数の装置がネットワーク接続されたシステム等の何れの構成であっても良い。
【０１０６】
また、本発明におけるコンピュータとは、パソコンに限らず、情報処理機器に含まれる演算処理装置、マイコン等も含み、プログラムによって本発明の機能を実現することが可能な機器、装置を総称している。
【０１０７】
なお、本願発明は、上記各実施形態に限定されるものでなく、実施段階ではその要旨を逸脱しない範囲で種々に変形することが可能である。また、各実施形態は可能な限り適宜組み合わせて実施してもよく、その場合、組み合わされた効果が得られる。さらに、上記各実施形態には種々の段階の発明が含まれており、開示される複数の構成要件における適宜な組み合わせにより種々の発明が抽出され得る。例えば実施形態に示される全構成要件から幾つかの構成要件が省略されることで発明が抽出された場合には、その抽出された発明を実施する場合には省略部分が周知慣用技術で適宜補われるものである。
【０１０８】
その他、本発明はその要旨を逸脱しない範囲で種々変形して実施できる。
【０１０９】
【発明の効果】
以上説明したように本発明によれば、多項式剰余系の演算に関し、任意の法多項式を扱え、必要なメモリサイズを低減でき、且つ処理効率を向上できる。
【図面の簡単な説明】
【図１】本発明の第１の実施形態に係る多項式剰余系演算装置の構成を示す模式図
【図２】同実施形態におけるＰＲＳ表現のモンゴメリ乗算のアルゴリズムを示す流れ図
【図３】本発明の第２の実施形態に係る多項式剰余系演算装置の構成を示す模式図
【図４】同実施形態におけるＰＲＳ表現を利用した楕円曲線上の点のスカラー倍算アルゴリズムを示す流れ図
【図５】図４の一部を詳細に説明するためのスカラー倍算アルゴリズムを示す流れ図
【符号の説明】
１０_１〜１０_ｎ…演算ユニット
１１_１〜１１_ｎ…ＲＯＭ
１２_１〜１２_ｎ…ＲＡＭ
１３_１〜１３_ｎ…積和回路
２０，３０…制御装置
４０…入出力部[0001]
TECHNICAL FIELD OF THE INVENTION
The present invention uses a GF (2^mThe present invention relates to a polynomial remainder-based arithmetic device, method and program for calculating elements of ()) at high speed by parallel processing.
[0002]
[Prior art]
In the field of public key cryptography, the key length tends to increase in order to ensure security in response to the sophistication of computers used by attackers and the sophistication of attack techniques. For example, at present, a key length of 1,024 bits is recommended in the RSA (Rivest-Shamir-Adleman) scheme used as a de facto standard of public key cryptography. In the elliptic DSA (Digital @ Signature @ Standard) scheme, which is one of the elliptic curve cryptosystems, a key length of 160 bits is currently recommended.
[0003]
Therefore, in the field of public key cryptography, when using such a long key length, it is an important issue how to process a very large integer operation or a very high-order polynomial operation at high speed. I have.
[0004]
Here, in the integer arithmetic processing, a residue arithmetic system (Residue \ Number \ System, hereinafter abbreviated as RNS) is known as one of the methods for speeding up. This RNS is a set of relatively prime integers {a₁, A₂, ..., a_n｝ Is prepared in advance, and a large integer to be calculated is represented by a set of remainders divided by these integers. Hereinafter, a set of integers ｛a prepared in advance₁, A₂, ..., a_n｝ Is called the base of the RNS, and the number n of elements constituting the base is called the size of the base. Let a set of bases be a = ｛a₁, A₂, ..., a_nExpressed by｝.
[0005]
For example, an integer x and a base ｛a₁, A₂, ..., a_nGiven｝, let x be the base element a_iThe remainder x divided by (i = 1, 2,..., N)_iSet (x₁, X₂, ..., x_n) Is the RNS representation of x. Where x_i= X mod a_i. At this time, x is the product A = a of all the base elements.₁a₂... a_nCan be uniquely expressed modulo. That is, if x is a positive integer less than A, x and its RNS expression (x₁, X₂, ..., x_n) Corresponds one-to-one.
[0006]
In this RNS expression, when calculating the sum of two integers x and y, the sum of each base element of x and y expressed in the RNS may be obtained, and the remainder after dividing by the corresponding base may be obtained. The same applies to subtraction. Regarding the multiplication, the product for each base element is obtained, and the remainder after division by the corresponding base is obtained.
[0007]
As described above, in the RNS, addition, subtraction, and multiplication may be performed by using the base modulo independently for each base element. For this reason, for example, by using an integer within the word length of the computer as a base, a very large integer operation can be realized by repeating single-precision operations. However, there are few known means for performing the division in the RNS expression more efficiently than the radix expression.
[0008]
As a method of efficiently performing the division in the RNS expression, Posch et al. And Kawamura et al. Proposed a method of performing the operation of the RSA cryptosystem of the public key cryptosystem at a high speed by using a residual arithmetic system. (For example, see Non-Patent Documents 1 and 2 and Patent Document 1).
[0009]
Posh and Kawamura's method uses a modular multiplication method (hereinafter referred to as Montgomery multiplication) proposed by Montgomery to avoid disadvantageous division in the operation in RNS expression (for example, see Non-Patent Document 3). The feature is that an integer represented by one RNS basis is represented by another basis using basis extension, and the like.
[0010]
Here, the basis extension is a basis a = ｛a₁, A₂, ..., a_n(X mod a₁, X mod a₂, ..., x mod a_n), The basis a∪ ｛b₁｝ = ｛A₁, A₂, ..., a_n, B₁(X mod a₁, X mod a₂, ..., x mod a_n, X mod b₁). In the above operation, the size of the base is increased by one. However, repeating this operation to increase the size of the base by n ′ (n ′ is an integer) and creating an RNS expression under the base is also called base extension. .
[0011]
On the other hand, in the elliptic curve cryptosystem, the extended field GF (2) of the field GF (2) of the characteristic 2 is used.^m) Is known as a method of constructing an elliptic curve based on a basic field. GF (2^mSince the element of ()) is expressed by a polynomial, an arithmetic method slightly different from the above-described integer arithmetic method is required.
[0012]
Hereinafter, GF (2^m) Is written as N (x) on the m-th irreducible polynomial on GF (2). GF (2^m) Can be regarded as a remainder obtained by dividing the polynomial on GF (2) by N (x), and can be represented by a polynomial of degree m-1 or less.
[0013]
GF (2^m) Is known as a polynomial residue arithmetic system (Polynominal Residue Arithmetic or Polynomial Residue System, hereinafter abbreviated as PRS) having a similar concept to RNS. This PRS is a set of polynomials {f} on GF (2) of relatively small order that are relatively prime.₁(X), f₂(X), ..., f_n(X)｝ is prepared in advance, and GF (2^m) Is expressed as a set of remainders obtained by dividing these elements by these polynomials. Hereinafter, a set of polynomials ｛f prepared in advance₁(X), f₂(X), ..., f_n(X)｝ is called the basis of the PRS, and the number n of elements constituting the basis is called the size of the basis. Further, a set of bases is represented by f = ｛f₁(X), f₂(X), ..., f_n(X) Expressed by｝.
[0014]
For example, GF (2^m) And the basis ｛f₁(X), f₂(X), ..., f_nGiven (x)｝, let a (x) be the basis f_i(X) remainder a divided by (i = 1, 2,..., N)_i(X) set (a₁(X), a₂(X), ..., a_n(X)) is the PRS expression of a (x). Where a_i(X) = a (x) mod f_i(X). At this time, a (x) is a product F (x) = f of all the base elements.₁(X) f₂(X) ... f_n(X) can be uniquely expressed modulo. That is, when the degree of F (x) is expressed as deg (F (x)), if a (x) is a polynomial less than deg (F (x)), a (x) and its PRS expression (a₁(X), a₂(X), ..., a_n(X)) corresponds one-to-one.
[0015]
When calculating the sum of two polynomials a (x) and b (x) in such a PRS expression, the sum of each base element of a (x) and b (x) expressed in the PRS may be obtained. As for the multiplication, first, the product for each base element is obtained, and the remainder after division by the corresponding base is obtained.
[0016]
As described above, in the PRS, addition and multiplication may be performed by using the base modulo independently for each base element. Therefore, for example, by using a polynomial of an order within the word length of the computer as a basis, an operation of a polynomial of an extremely large order can be realized by repeating single-precision arithmetic. However, there are few known means for performing division in the PRS expression more efficiently than in the ordinary polynomial expression.
[0017]
Koc et al. Have proposed a remainder multiplication method in PRS expression as a method for efficiently performing division in PRS expression (for example, see Non-Patent Document 4).
[0018]
The feature of the Koc method is that a multiple table of the modulo polynomial N (x) is prepared in advance in order to avoid division by PRS. As a result, when performing division, a polynomial close to the polynomial to be divided can be retrieved from the multiple table and subtracted.
[0019]
[Non-patent document 1]
Posch, "Modulo Reduction in Residue Number System", iTransaction on Parallel and Distributed Systems (IEEE Translator and Online), and "Modulo Reduction in Residue Number System". Systems), May 1995, @Vol. 6, No. $ 5, $ pp. 449-454
[0020]
[Non-patent document 2]
Posch, “RNS-Modulo Reduction-upon-Restricted Base Value Set and It's Applicability to RSA Cryptography (RNS-Modulo-Reduction-Upon-a-Restricted-Base) Value Set and It's Applicability to RSA Cryptography, "Computer & Security, 1998, Vol. $ 17, $ pp. 637-650
[0021]
[Patent Document 1]
JP-A-2001-194993
[0022]
[Non-Patent Document 3]
Montgomery, "Modular Multiplication Without Trial Division", The Mathematicals of Computation (Mathmatics, March, 19th April, April, April 2008). 44, No. 170, @pp. 519-521
[0023]
[Non-patent document 4]
Koc et al., "Parallel Multiplication in GF (2) Power of Two Using Polynomial Residue Arismetic (Parallel @ multiplication @ in @ GF (2)^k) \ Using \ polynomial \ residue \ arithmetic, "Designs Causes and Cryptography, Designs, Codes and Cryptography, June 2000, 20 (2), pp. 155-173.
[0024]
[Problems to be solved by the invention]
However, it is considered that the Koc method described above has room for improvement in the following three points.
The first point is that the preparation of the multiple table of the modal polynomial limits the modulo polynomial that can be handled. That is, when the multiple table is written in the storage device of the arithmetic device, the arithmetic device can only perform the operation using the modal polynomial.
[0025]
The second point is that the multiple table is huge. For example, if the base polynomial is 16 bits and the modulus polynomial N (x) is 160 bits, the multiple table requires a memory size of about 1.25 Mbytes. Storing such a multiple table is impractical.
[0026]
The third point is that, in order to search the multiple table, the PRS-expressed polynomial and the corresponding ordinary polynomial are simultaneously calculated. For this reason, it is considered that the significance of performing the calculation in the PRS expression is reduced by performing the calculation of the expression of the ordinary polynomial in addition to reducing the efficiency by performing the double processing.
[0027]
That is, it is considered that the Koc method does not fully utilize the efficient operation characteristics of the PRS expression.
[0028]
SUMMARY OF THE INVENTION The present invention has been made in view of the above circumstances, and provides a polynomial remainder system operation device, method, and program that can reduce the required memory size and improve processing efficiency with respect to polynomial residue system operations. Aim.
[0029]
[Means for Solving the Problems]
According to a first aspect, a base {f} of a preset polynomial remainder operation system is used.₁(X), f₂(X), ..., f_n(X)｝ and ｛g₁(X), g₂(X), ..., g_n(X) each base element f of｝_i, G_i(I = 1, 2,..., N), a polynomial remainder system operation device including a plurality of operation units having a polynomial remainder operation function on GF (2), wherein the GF (2) input means for inputting m-order irreducible polynomial N (x) and polynomials a (x) and b (x) on GF (2) of degree less than m to each arithmetic unit; Each base element f_i, G_iAnd each of the base elements f based on the input contents N (x), a (x), b (x)_i, G_iCalculation means for causing each operation unit to execute the remainder operation in parallel in parallel, and G (x) = g₁(X) g₂(X) ... g_nMontgomery multiplication a (x) b (x) G (x) using G (x) defined by (x)^-1And a Montgomery multiplication control means for controlling the remainder operation control means so as to calculate mod N (x).
[0030]
Thus, unlike the conventional method, without using a multiple table that requires a huge memory size, and without performing calculations in the ordinary polynomial expression, each arithmetic unit can be processed in parallel using the polynomial residue system expression. The calculation is being executed. In addition, since a parameter that limits the modulus polynomial, such as a multiple table of the modulus polynomial, is not used, calculation can be performed on an arbitrary modulus polynomial. Furthermore, in order to avoid division, Montgomery multiplication, which has not been conventionally used in polynomial residue system representation, is used as a parallel operation.
Therefore, regarding the operation of the polynomial remainder system, the required memory size can be reduced and the processing efficiency can be improved.
[0031]
Although the first invention is described as an “apparatus”, it is needless to say that the first invention may be expressed as a “system”, a “method”, a “program”, a “computer-readable storage medium”, or the like.
[0032]
BEST MODE FOR CARRYING OUT THE INVENTION
Hereinafter, embodiments of the present invention will be described with reference to the drawings, but before that, the principle of the present invention will be described.
[0033]
Montgomery multiplication on GF (2) calculates a (x) b (x) R (x) for input polynomials a (x), b (x), and N (x).^-1This is an algorithm for outputting {mod} N (x), and includes the following five steps ST1 to ST5.
[0034]
(ST1) s (x) ← a (x) b (x)
(ST2) t (x) ← s (x) N (x)^-1Mod R (x)
(ST3) u (x) ← t (x) N (x)
(ST4) v (x) ← s (x) + u (x)
(ST5) w (x) ← v (x) / R (x)
Here, s (x), t (x), u (x), v (x), w (x) represent intermediate variables.
R (x) is a polynomial whose degree deg (R (x)) is larger than the degree deg (N (x)) of the modulus polynomial N (x) and is relatively prime to N (x).
[0035]
To implement the above Montgomery multiplication by PRS, the following seven steps ST11 to ST17 may be performed. The seven steps ST11 to ST17 are similar to the Montgomery multiplication algorithm in the RNS expression proposed by Posh et al.
[0036]
(ST11) <s (x)>_f= <A (x)>_f<B (x)>_f, <S (x)>_g= <A (x)>_g<B (x)>_g
(ST12) <t (x)>_g= <S (x)>_g<N (x)^-1>_g
(ST13) <t (x)>_g<T (x)> from_fAsk for
(ST14) <u (x)>_f= <T (x)>_f<N (x)>_f
(ST15) <v (x)>_f= <S (x)>_f+ <U (x)>_f
(ST16) <w (x)>_f= <V (x)>_f<G (x)^-1>_f
(ST17) <w (x)>_f<W (x)> in base extension from_gAsk for
Here, <s (x)>_fAnd the like represent a PRS representation of a polynomial that is {s (x)} in a normal polynomial representation using a basis f.
[0037]
In order to correctly process the above seven steps, it is necessary to satisfy a condition of deg (N (x)) <deg (F (x)) and a condition of deg (N (x)) <deg (G (x)). There is.
[0038]
From these two conditions, a (x) can be expressed only by the base f or the base g, so that <a (x)>_f, <A (x)>_gRepresenting {a (x)} with a pair of {} is redundant.
However, the product s (x) of the polynomials a (x) and b (x) may have an order deg (s (x)) larger than deg (F (x)) and deg (G (x)). Therefore, it can be correctly expressed only when f∪g is used as a basis. Note that, in general, the size of the basis f and the basis g are different. However, as a special case, when the sizes of both bases f and g are set to be equal, there is an advantage that the arithmetic unit of the base f and the arithmetic unit of the base g can be shared.
[0039]
Next, the base extension of steps ST13 and ST17 of the Montgomery multiplication algorithm of the PRS expression will be described.
Now, let β (x) be a polynomial of deg (β (x)) {<deg (F (x))}, and express its PRS expression as <β (x)>_f= (Β₁(X), β₂(X), ..., β_n(X)).
[0040]
This PRS-represented polynomial <β (x)>_fPolynomial <β (x)> after base extension from_{f ∪ g}Suppose you want At this time, the following equation (1) is established from the well-known Chinese remainder theorem.
[0041]
(Equation 1)

[0042]
Where F_i(X) = F (x) / f_i(X). F_i(X)^-1Is the law f_iF in (x)_iThis is the multiplicative inverse of (x).
[0043]
The above equation (1) may be written as the following equation (2).
[0044]
(Equation 2)

[0045]
Here, the order before the application of mod @ F (x) on the right side is smaller than deg (F (x)) as follows.
[0046]
max @ deg (f_i(X)) + deg (F_i(X))｝ <max ｛deg (f_i(X)) + deg (F (x))-deg (f_i(X))｝ = deg (F (x))
Therefore, the expression (2) omits mod F (x) and is expressed as the following expression (3).
(Equation 3)

According to equation (3), β (x) can be obtained by multiplication and addition.
[0047]
<Β (x)>_gRepresents β (x) obtained in this manner with each base element g_i(X) It is obtained by calculating the remainder at.
[0048]
Next, each embodiment of the present invention for realizing the Montgomery multiplication algorithm using the above PRS expression will be described with reference to the drawings.
(1st Embodiment)
FIG. 1 is a schematic diagram showing a configuration of a polynomial remainder system operation device according to the first embodiment of the present invention. This polynomial remainder system arithmetic unit comprises n arithmetic units 10₁-10_nAre connected to the control device 20.
[0049]
Here, each operation unit 10₁-10_nAre controlled by the controller 20 to perform modular multiplication of a single-precision polynomial.₁~ 11_n, RAM12₁~ 12_nAnd product-sum circuit 13₁~ 13_nIt has. Note that each arithmetic unit 10₁-10_nHave the same configuration as each other._i(Where i = 1, 2,..., N) will be described as a representative example. The operation unit 10_iEach element 11 of_i, 12_i, 13_iThe same is true for
[0050]
ROM11_iIs a read-only memory that is read-controlled by the control device 20, and the product-sum circuit 13_iBase element f used in_i, G_i,And f_iMultiplicative inverse value F modulo (x)_i(X)^-1mod @ f_i(X), g_iMultiplicative inverse value G modulo (x)_i(X)^-1mod @ g_i(X), pre-calculated <F_i(X)>_g,<G_i(X)>_f(I = 1, 2,..., N), <G^-1(X)>_fAre held, and the held contents are controlled by the control device 20 so that the corresponding product-sum circuit 13_iCan be transferred to
[0051]
Note that n base elements ｛f of the polynomial remainder system₁, ..., f_nFor。, a polynomial which is relatively prime to any two is used. The other n base elements ｛g₁, ..., g_nThe same applies to｝. In general, the number n of base elements of the polynomial remainder system and the product-sum circuit 13₁~ 13_nDoes not need to coincide with the number n, but for the sake of simplicity, it is assumed that both are n.
[0052]
Multiplicative inverse value F_i(X)^-1mod @ f_i(X), G_i(X)^-1mod @ g_i(X) and <F_i(X)>_g,<G_i(X)>_f(I = 1, 2,..., N), <G^-1(X)>_fIs a value determined once the basis of the polynomial remainder system is determined, and is pre-calculated and stored._iNot limited to, RAM12_iAlternatively, the program may be stored in another memory (for example, an EEPROM) not shown.
[0053]
RAM (storage device) 12_iIs an as-necessary write / read memory controlled by the control device 20 to read / write._iInput data and the product-sum circuit 13_iResult data of the operation from the_iIt is used to hold data such as output data to the outside. The RAM 12_iIs pre-calculated <N (x)>_f, <N (x)^-1>_g<N (x)>_fIs held. The RAM 12_iMay be any writable storage device. For example, instead of the RAM, any rewritable storage device such as an EAROM (electrically readable, only available, only memory) or an EEPROM (electrically erasable, programmable, read only, only memory) or the like may be used. It has become.
[0054]
The control device 20 controls each operation unit 10 based on the Montgomery multiplication algorithm shown in FIG._iIt has a function to execute a predetermined operation by controlling the input and output data. Here, each step ST11 to ST17 of the Montgomery multiplication algorithm in FIG. 2 corresponds to the seven steps ST11 to ST17 in the PRS described above. In addition, each operation unit 10_iIs controlled by, for example, each product-sum circuit 13_i, A control signal is applied to the selector, and the product-sum circuit 13_iIt can be realized by selecting an addition circuit or a multiplication circuit (not shown).
[0055]
Also, each of the arithmetic units 10 as described above_iThe control device 20 can be configured by hardware or a combination of hardware and software. Here, each operation unit 10_iWhen the control device 20 is configured by hardware and software, a program for realizing each function to be described later is previously installed in the computer of the polynomial remainder system arithmetic device as software. It should be noted that each arithmetic unit 10 can be implemented by hardware or a combination of hardware and software._iThe description that the control device 20 can be individually configured also applies to the following embodiments.
[0056]
Next, a polynomial residue system operation method using the polynomial residue system operation device configured as described above will be described with reference to FIG.
First, the basis f_i(X), g_i(X) is the ROM 11_iIs held in. The inputs a (x), b (x), and the modulus N (x) are transmitted by the control unit 20 to each arithmetic unit 10._iIs set to
[0057]
(ST11) Each arithmetic unit 10_iPerforms a (x) × b (x) under two bases f and g, respectively. For example, <a (x)> under the basis f_f× <b (x)>_fIs performed as follows.
[0058]
That is, the RAM 12_i<A (x)>_f, <B (x)>_fIth component a of_i(X), b_i(X) and the ROM 11_iThe base element f in_i(X) and the product-sum circuit 13_iIs a_i(X) × b_i(X) \ mod \ f_i(X) is calculated and the calculation result s_i(X) in RAM 12_iTo be stored.
[0059]
(ST12) Each arithmetic unit 10_i<S (x)> is an operation of only the base g and is obtained in step 1._gAnd the RAM 12_i<N (x)^-1>_gAnd multiply by Note that <N (x)^-1>_gIs RAM12_iIs stored in
[0060]
(ST13) Each arithmetic unit 10_iIs <t (x)>_gIs converted to a representation from base g to base f. Base extension is performed based on equation (3) (β (x) = t (x), and the roles of f and g are switched).
[0061]
First, each operation unit 10_jIs the RAM12_j<T (x)> within_gJ-th component t of_j(X) and the ROM 11_jG in_j(X)^-1Mod g_j(X), base element g_j(X) The product-sum circuit 13_jBy t_j(X) × G_j(X)^-1Mod g_j(X) is calculated, and the calculation result h_j(X) for all j₁, RAM12₂, ..., RAM12_nStore in everything. Here, there is a connection (not shown) between the operation units._iTo be stored.
[0062]
Next, this calculation result h₁(X) and ROM 11_iG in₁(X) \ mod \ f_i(X), base element f_iUsing (x), the product-sum circuit 13_iBy h₁(X) × G₁(X) \ mod \ f_i(X) is calculated, and the calculation result k_1i(X) in RAM 12_iTo be stored.
[0063]
Next, the RAM 12_iH in₂(X) and ROM 11_iG in₂(X) \ mod \ f_i(X), base element f_iUsing (x), the product-sum circuit 13_iBy h₂(X) × G₂(X) \ mod \ f_i(X) is calculated, and the calculation result and the RAM 12_iK in_1iK obtained by adding (x)_2i(X) in RAM 12_iTo be stored.
[0064]
Similarly, G₃(X) \ mod \ f_i(X), ..., G_n(X) \ mod \ f_iUsing (x) in order_3i(X), ..., k_ni(X), and t (x) ｘmod f_i(X) = k_ni(X), <t (x)>_fYou can get.
[0065]
(ST14) Each arithmetic unit 10_iIs <t (x)> obtained in step ST13._fAnd the RAM 12_i<N (x)>_f積 and the product-sum circuit 13_iAnd the multiplication result <u (x)>_fTo RAM12_iTo be stored. Here, <N (x)>_fMeans RAM12_iIs stored in
[0066]
(ST15) Each arithmetic unit 10_iIs <s (x)> obtained in step ST11._f<U (x)> obtained in step ST14_fAnd the product-sum circuit 13_iAnd the addition result <v (x)>_fTo RAM12_iTo be stored.
[0067]
(ST16) Each arithmetic unit 10_iIs <v (x)> obtained in step ST15._fAnd ROM11_i<G (x)^-1>_fAnd the product-sum circuit 13_iAnd multiplication result <w (x)>_fTo RAM12_iTo be stored. Here, <G (x)^-1>_fIs calculated in advance in ROM11_iIs stored in
<W (x)> obtained in step ST16_f, A (x) b (x) G (x)^-1All information of {mod} N (x) is included.
[0068]
(ST17) {When this algorithm is used repeatedly, each arithmetic unit 10_iIs <w (x)> in step ST16 in order to obtain the next input._fIs converted from a basis f to a basis g.
[0069]
As described above, according to the present embodiment, unlike the related art, a polynomial residue system expression is used without using a multiple table requiring a huge memory size and without performing calculations in a normal polynomial expression. In this way, each arithmetic unit is caused to execute an arithmetic operation in parallel. In addition, since a parameter that limits the modulus polynomial, such as a multiple table of the modulus polynomial, is not used, calculation can be performed on an arbitrary modulus polynomial. Furthermore, in order to avoid division, Montgomery multiplication, which has not been conventionally used in polynomial residue system representation, is used as a parallel operation.
Therefore, regarding the operation of the polynomial remainder system, it is possible to reduce the required memory size and improve the processing efficiency, and it is possible to handle any arbitrary polynomial.
[0070]
Supplementally, in the prior art, a large multiple table is required, or the efficiency is reduced by performing a double process using the PRS expression and the ordinary polynomial expression, but in the present embodiment, the multiple table is unnecessary. Since the calculation is closed in the PRS expression, it can be processed efficiently. In the prior art, the number of modal polynomials that can be handled by preparing a multiple table is limited. However, in the present embodiment, any modulo polynomial can be handled as long as it is relatively prime to the base element.
[0071]
In addition, in the present embodiment, Montgomery multiplication in the PRS expression can be performed, so that processing can be performed more efficiently.
[0072]
(Second embodiment)
FIG. 3 is a schematic diagram showing the configuration of a polynomial remainder system arithmetic unit according to a second embodiment of the present invention. The same parts as those in FIG. 1 are denoted by the same reference numerals, and detailed description thereof will be omitted. The parts are mainly described.
[0073]
The present embodiment is an application example in which Montgomery multiplication of the PRS expression in the first embodiment is used for elliptic curve cryptography, and is a control that performs control based on an algorithm of elliptic curve cryptography instead of the control device 20 in FIG. Device 30 and each arithmetic unit 10_i, A common input / output unit (I / O in the figure) 40 is provided.
[0074]
Here, the control device 30 determines that GF (2^m) Is for performing scalar multiplication of points on the elliptic curve necessary for the above-mentioned processing of the elliptic curve encryption, and based on the scalar multiplication algorithm shown in FIG. 4 and FIG._iIt has a function to execute a predetermined operation by controlling the input and output data.
[0075]
The input / output unit 40 is connected to the outside of the polynomial remainder system arithmetic unit and to each arithmetic unit 10_iThis is an interface for inputting and outputting data to and from.
[0076]
Next, a polynomial residue system operation method in the polynomial residue system operation device configured as described above will be described with reference to FIGS. Here, FIG. 4 shows an algorithm for performing scalar multiplication of a point on an elliptic curve in the PRS, and FIG. Is shown.
[0077]
First, a description will be given with reference to FIG.
(ST21) {The external CPU, not shown, converts the scalar k into_iTo enter. In addition, the input / output unit 40 outputs a point (P_x(X), P_y(X)) and the modulus N (x)_iTo enter.
[0078]
(ST22) GN (x) 2 = G (x) 2 mod N (x) is calculated by a remainder multiplier in an ordinary polynomial expression (not shown).
[0079]
(ST23) {Each arithmetic unit 10}_iIs an ordinary polynomial expression G_{N (x)} ², N (x), P_x(X), P_y(X) is converted to a PRS expression. This conversion is performed by the product-sum circuit 13_iIf the bit size of L is L, for example, to express N (x) in PRS expression,
(Equation 4)

[0080]
(ST24) {Each arithmetic unit 10}_iIs <N (x) required for Montgomery multiplication^-1>_gIs calculated. <N (x)^-1>_gIs g_i(X) Carmichael number λ_iIs calculated in advance, and N_i(X)^{λ i}Mod g_iDetermined by (x).
[0081]
(ST25) {Each arithmetic unit 10}_iIs displayed in affine coordinates (<P_x(X)>_{f ∪ g}, <P_y(X)>_{f ∪ g}) In projective coordinates and the Montgomery operation area (<P_mx(X)>_{f ∪ g}, <P_my(X)>_{f ∪ g}, <G_{N (x)}>_{f ∪ g}).
This transformation is <G for x, y coordinates._{N (x)} ²>_{f ∪ g}It can be calculated by Montgomery multiplication with. For the z coordinate, 座標 <G_{N (x)} ²>_{f ∪ g}And <1>_{f ∪ g}It can be calculated by Montgomery multiplication of.
[0082]
(ST26) {Each arithmetic unit 10}_iIs a point on the elliptic curve (<P_mx(X)>_{f ∪ g}, <P_my(X)>_{f ∪ g}, <G_{N (x)}>_{f ∪ g}) By k times (<Q_pmx(X)>_{f ∪ g}, <Qpmy (x)>_{f ∪ g}, <Q_pmz(X)>_{f ∪ g}Get). Step ST26 will be described later in detail with reference to FIG.
[0083]
(ST27) {Each arithmetic unit 10}_iIs (<Q_pmx(X)>_{f ∪ g}, <Q_pmy(X)>_{f ∪ g}, <Q_pmz(X)>_{f ∪ g}) From the Montgomery operation area to the normal area (<Q_Px(X)>_{f ∪ g}, <Q_Py(X)>_{f ∪ g}, <Q_Pz(X)>_{f ∪ g}). This conversion is based on each component and <1>_{f ∪ g}It can be calculated by Montgomery multiplication with.
[0084]
(ST28) {Each arithmetic unit 10}_iIs <Q_Px(X)>_{f ∪ g}, <Q_Py(X)>_{f ∪ g}, <Q_Pz(X)>_{f ∪ g}To the ordinary polynomial expression Q_Px(X), Q_Py(X), Q_Pz(X).
For example, <Q_Px(X)>_fIs performed as follows.
ξ_i(X) = Q_Pxi(X) G_i(X)^-1Mod g_i(X)
age,
(Equation 5)

[0085]
This gives Q_PxAn ordinary polynomial expression of (x) is obtained. Q_PxSince (x) can be expressed only by the base f, <Q_Px(X)>_gNo operation is required for
[0086]
(ST29) {Each arithmetic unit 10}_iIs a point on the elliptic curve (Q_Px(X), Q_Py(X), Q_Pz(X)) is displayed in affine coordinates (Q_x(X), Q_y(X)).
[0087]
(ST30) Each arithmetic unit 10_iIs (Q_x(X), Q_P(X)) is output.
[0088]
Next, the scalar multiplication in step ST26 will be described in detail with reference to FIG.
[0089]
(ST26-1) {Each arithmetic unit 10}_iIs input as a scalar k and a point on the elliptic curve (P_Pmx(X), P_Pmy(X), P_Pmz(X)).
[0090]
(ST26-2) {Each arithmetic unit 10}_iIs (Q_Pmx(X), Q_Pmy(X), Q_Pmz(X)) to (P_Pmx(X), P_Pmy(X), P_Pmz(X)). Hereinafter, the ith bit when the scalar k is expressed in bits is represented by k_cWill be represented by MSB (most significant) bit k of scalar k_m-1To k₁Perform the following loop in order.
[0091]
(ST26-3) {Each arithmetic unit 10}_iIs (Q_Pmx(X), Q_Pmy(X), Q_Pmz(X)) is doubled.
[0092]
(Q_Pmx(X), Q_Pmy(X), Q_Pmz(X)) ← DBL ((Q_Pmx(X), Q_Pmy(X), Q_Pmz(X)), (Q_Pmx(X), Q_Pmy(X), Q_Pmz(X))). Here, DBL () means doubling of a point on the elliptic curve.
[0093]
(ST26-4) The control device 30 sets k_c= 1 or not, and k_cIf = 1, the process proceeds to step S26-5. k_cIf = 0, the process returns to the beginning of the loop (ST26-3) without performing this addition. Note that the value of c is decremented by one each time the loop returns to the beginning.
[0094]
(ST26-5) {Each arithmetic unit 10}_iIs (Q_Pmx(X), Q_Pmy(X), Q_Pmz(X)) to (P_Pmx(X), P_Pmy(X), P_Pmz(X)).
[0095]
(Q_Pmx(X), Q_Pmy(X), Q_Pmz(X)) ← ADD ((Q_Pmx(X), Q_Pmy(X), Q_Pmz(X)), (P_Pmx(X), P_Pmy(X), P_Pmz(X))). Here, ADD () means addition of points on the elliptic curve.
[0096]
(ST26-6) The control device 30 determines whether or not c = 1, and if c ≠ 1, reduces the value of c by 1 and returns to the beginning of the loop (ST26-3). When c = 1, the loop ends and the process proceeds to step ST26-7.
[0097]
(ST26-7) {Each arithmetic unit 10}_iIs (Q_Pmx(X), Q_Pmy(X), Q_Pmz(X)), and the process proceeds to step ST27.
[0098]
Thus, step ST26 is completed. Here, FIG. 5 is described in an ordinary polynomial expression, but scalar multiplication in the PRS expression can be easily realized by replacing each element with the PRS expression. At this time, the remainder multiplication necessary for ADD () and DBL () is performed using the Montgomery multiplication algorithm based on the PRS expression shown in the first embodiment.
[0099]
As described above, according to the present embodiment, in addition to the effects of the first embodiment, scalar multiplication of points on an elliptic curve can be efficiently performed.
[0100]
The method described in each of the above embodiments may be a computer-executable program such as a magnetic disk (floppy (registered trademark) disk, hard disk, etc.), an optical disk (CD-ROM, DVD, etc.), a magneto-optical disk ( MO) and a storage medium such as a semiconductor memory.
[0101]
The storage medium may be in any form as long as it can store a program and can be read by a computer.
[0102]
Further, an OS (Operating System) running on the computer based on an instruction of a program installed in the computer from a storage medium, MW (Middleware) such as database management software, network software, etc. realize the present embodiment. May be partially executed.
[0103]
Further, the storage medium in the present invention is not limited to a medium independent of a computer, but also includes a storage medium in which a program transmitted through a LAN, the Internet, or the like is downloaded and stored or temporarily stored.
[0104]
Further, the number of storage media is not limited to one, and the case where the processing in the present embodiment is executed from a plurality of media is also included in the storage medium of the present invention, and any media configuration may be used.
[0105]
Note that the computer according to the present invention executes each process in the present embodiment based on a program stored in a storage medium, and includes a device such as a personal computer and a system in which a plurality of devices are connected to a network. Or any other configuration.
[0106]
Further, the computer in the present invention is not limited to a personal computer, but also includes an arithmetic processing unit, a microcomputer, and the like included in an information processing device, and is a general term for devices and devices that can realize the functions of the present invention by a program. .
[0107]
Note that the present invention is not limited to the above embodiments, and various modifications can be made in the implementation stage without departing from the scope of the invention. In addition, the embodiments may be implemented in appropriate combinations as much as possible, in which case the combined effects can be obtained. Furthermore, the above-described embodiments include inventions at various stages, and various inventions can be extracted by appropriately combining a plurality of disclosed constituent elements. For example, when an invention is extracted by omitting some constituent elements from all constituent elements described in the embodiment, when implementing the extracted invention, the omitted part is appropriately supplemented by well-known conventional techniques. It is something to be done.
[0108]
In addition, the present invention can be variously modified and implemented without departing from the gist thereof.
[0109]
【The invention's effect】
As described above, according to the present invention, regarding the operation of the polynomial remainder system, any modal polynomial can be handled, the required memory size can be reduced, and the processing efficiency can be improved.
[Brief description of the drawings]
FIG. 1 is a schematic diagram illustrating a configuration of a polynomial remainder-based arithmetic device according to a first embodiment of the present invention.
FIG. 2 is a flowchart showing an algorithm of Montgomery multiplication of a PRS expression in the embodiment.
FIG. 3 is a schematic diagram showing a configuration of a polynomial remainder system operation device according to a second embodiment of the present invention.
FIG. 4 is a flowchart showing a scalar multiplication algorithm of a point on an elliptic curve using a PRS expression in the embodiment.
FIG. 5 is a flowchart showing a scalar multiplication algorithm for explaining a part of FIG. 4 in detail;
[Explanation of symbols]
10₁-10_n… Calculation unit
11₁~ 11_n… ROM
12₁~ 12_n… RAM
13₁~ 13_n… Sum-and-sum circuit
20, 30 ... control device
40 ... input / output unit

Claims (6)

Basis of preset polynomial remainder calculation system _{{f 1 (x), f} 2 (x), ..., f n (x)} and _{{g 1 (x), g} 2 (x), ..., g n ( x) Based on each base element f _i , g _i (i = 1, 2,..., n) of｝, a polynomial residue system operation including a plurality of operation units having a polynomial residue operation function on GF (2) A device,
An m-order irreducible polynomial N (x) on the GF (2) and polynomials a (x) and b (x) on the GF (2) of an order less than m are input to each arithmetic unit. Input means;
Each base element _f i said set, _{g i} and the inputted input content N (x), on the basis of a (x), b (x ), the base element _f i, the remainder operation on _{g i} A remainder operation control means for causing each operation unit to execute in parallel;
_G (x) to the arithmetic units _{= g 1 (x) g 2} (x) ... g n (x) using been G (x) is defined in the Montgomery multiplication a (x) b (x) G (x ) Montgomery multiplication control means for controlling the remainder operation control means so as to calculate ^-1 mod N (x);
A polynomial remainder system arithmetic unit comprising: 2. The polynomial remainder arithmetic unit according to claim 1,
Elliptic curve operation controlling each of the arithmetic units and the Montgomery multiplication control means so as to execute a scalar multiplication operation on a point on an elliptic curve defined on GF (2 ^m ) according to a predetermined algorithm using the Montgomery multiplication. Control means,
A polynomial remainder system arithmetic unit comprising: Basis of preset polynomial remainder calculation system _{{f 1 (x), f} 2 (x), ..., f n (x)} and _{{g 1 (x), g} 2 (x), ..., g n ( x) Based on each base element f _i , g _i (i = 1, 2,..., n) of｝, a polynomial residue system operation using a plurality of operation units having a polynomial residue operation function on GF (2) The method,
The m-order irreducible polynomial N (x) on the GF (2) and the polynomials a (x) and b (x) on the GF (2) of an order less than m are input to the storage device of each arithmetic unit. Input process for performing
Each base element _f i said set, _{g i} and the inputted input content N (x), on the basis of a (x), b (x ), the base element _f i, the remainder operation on _{g i} A remainder operation control step of causing each operation unit to execute in parallel and storing an execution result in a storage device of each operation unit;
_G (x) to the arithmetic units _{= g 1 (x) g 2} (x) ... g n (x) using been G (x) is defined in the Montgomery multiplication a (x) b (x) G (x A) Montgomery multiplication control step of controlling the remainder operation control step so as to calculate ⁻¹ mod N (x);
And a polynomial remainder system operation method. 4. The method according to claim 3, wherein:
According to a predetermined algorithm using the Montgomery multiplication, each arithmetic unit and the Montgomery multiplication control step are controlled so that each arithmetic unit executes a scalar multiplication operation on a point on an elliptic curve defined on GF (2 ^m ). Elliptic curve calculation control process,
And a polynomial remainder system operation method. Basis of preset polynomial remainder calculation system _{{f 1 (x), f} 2 (x), ..., f n (x)} and _{{g 1 (x), g} 2 (x), ..., g n ( x) Based on each base element f _i , g _i (i = 1, 2,..., n) of｝, a plurality of operation units having a polynomial remainder operation function on GF (2) and each operation unit are controlled. A polynomial remainder-based arithmetic device having a control device for the program used in the control device,
Computer of the control device,
The m-order irreducible polynomial N (x) on the GF (2) and the polynomials a (x) and b (x) on the GF (2) of an order less than m are input to the storage device of each arithmetic unit. Input means for
Each base element _f i said set, _{g i} and the inputted input content N (x), on the basis of a (x), b (x ), the base element _f i, the remainder operation on _{g i} Remainder operation control means for causing each operation unit to execute in parallel and storing an execution result in a storage device of each operation unit;
_G (x) to the arithmetic units _{= g 1 (x) g 2} (x) ... g n (x) using been G (x) is defined in the Montgomery multiplication a (x) b (x) G (x ) Montgomery multiplication control means for controlling said remainder operation control means so as to calculate ^-1 mod N (x);
Program to function as The program according to claim 5,
Computer of the control device,
In accordance with a predetermined algorithm using the Montgomery multiplication, each arithmetic unit and the Montgomery multiplication control means are controlled so that each arithmetic unit executes a scalar multiplication of a point on an elliptic curve defined on GF (2 ^m ). Elliptic curve calculation control means,
Program to function as

Images